CVE-2013-6440: The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Feb 14, 2014

CVE-2013-6440

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to…

–

CVSS

2.8%

EPSS

No

On KEV

Description

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.8% · higher than 86% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OP

Opensaml · Internet2

2.0; 2.1.0; 2.2.0 · source: NVD

Affected product

OP

Opensaml

Internet2

All Opensaml CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2013-6440

https://www.cve.org/CVERecord?id=CVE-2013-6440

blog.sendsafely.com

http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml

http://rhn.redhat.com/errata/RHSA-2014-0170.html

http://rhn.redhat.com/errata/RHSA-2014-0171.html

http://rhn.redhat.com/errata/RHSA-2014-0172.html

http://rhn.redhat.com/errata/RHSA-2014-0195.html

http://shibboleth.net/community/advisories/secadv_20131213.txt

More from Opensaml

–

Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth…

–

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use…